So far, only 1 that cause a message to be held. On the other hand, I find considerable overlap with some of the other big name tests, so I'm catching more spam than I did, while also making the stuff I caught before score even higher.
That is why I stopped using the DUL list; it's a list of dynamic subnets at various ISPs, not a list of confirmed IPs used by spammers. Using the DUL would be fine if I had the default HOP settings, because that would catch workstations that are sending directly to my mail gateway. However, I have HOPHIGH set to 2, which should give me a lot of false positives. For what it's worth, I hold on WEIGHT20, and have the WARN action for all the tests I indicated, except SORBS-ZOMBIE, for which I HOLD. Andrew 8) -----Original Message----- From: Omar K. [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2003 5:03 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SORBS How are the false positive rates ? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Thursday, August 28, 2003 12:30 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] OSRELAY question. Until a few days ago, I was using SORBSALL, but on checking out their home page, I found that it had grown quite a lot since I started using it. Since JunkMail will only incur the lookup once, I suggest that if you're using SORBS that you break it up into all the little tests to query the same rbl, and set your weights accordingly. I found that a) this is much more flexible and b) much more effective, very spammy sources are listed under multiple categories. Check out the bottom of the page for the description and usage of the individual tests and return codes, then set your weights and actions as you see fit: http://www.dnsbl.sorbs.net/using.html Andrew 8) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
